Re: [RFC PATCH v1.1 05/11] mm/damon/sysfs-schemes: kobject_del() scheme filter dirs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Incomplete bug fix: missing kobject_del() in damos_sysfs_probes_rm_dirs() and damon_sysfs_schemes_add_dirs() error path.
--

commit ada3b579d341495d80858ab88063949ce50e3fd8
Author: SeongJae Park <sj@kernel.org>

mm/damon/sysfs-schemes: kobject_del() scheme filter dirs

This commit fixes directory creation failures caused by name conflicts by
adding kobject_del() calls for scheme filter directories when
CONFIG_DEBUG_KOBJECT_RELEASE is enabled.

> diff --git a/mm/damon/sysfs-schemes.c b/mm/damon/sysfs-schemes.c
> index bf08e6e1f1635..300930c2c5b3f 100644
> --- a/mm/damon/sysfs-schemes.c
> +++ b/mm/damon/sysfs-schemes.c
> @@ -914,8 +914,10 @@ static void damon_sysfs_scheme_filters_rm_dirs(
>  	struct damon_sysfs_scheme_filter **filters_arr = filters->filters_arr;
>  	int i;
>  
> -	for (i = 0; i < filters->nr; i++)
> +	for (i = 0; i < filters->nr; i++) {
> +		kobject_del(&filters_arr[i]->kobj);
>  		kobject_put(&filters_arr[i]->kobj);
> +	}

[Severity: High]
This is a pre-existing issue, but while we are adding kobject_del() here to 
prevent name conflicts, are there other locations that need the same fix?

For instance, in damos_sysfs_probes_rm_dirs(), the code iterates over 
probes_arr and calls kobject_put() without a preceding kobject_del():

	for (i = 0; i < probes->nr; i++)
		kobject_put(&probes_arr[i]->kobj);

Additionally, in the error path of damon_sysfs_schemes_add_dirs(), if 
damon_sysfs_scheme_add_dirs() fails after a successful kobject_init_and_add(), 
the cleanup jumps to the out label:

out:
	damon_sysfs_schemes_rm_dirs(schemes);
	kobject_put(&scheme->kobj);
	return err;

Could these missing kobject_del() calls leave sysfs directories pending
delayed release, allowing the same name conflict crashes to occur?

>  	filters->nr = 0;
>  	kfree(filters_arr);
>  	filters->filters_arr = NULL;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260617144807.91441-1-sj@kernel.org?part=5